# INIT startup order (K1246–K1250)

A validated fixed-capacity manifest transfers into `Plan`. Rules correspond
to manifest entries and may name one prerequisite. Compilation rejects unknown
or cyclic prerequisites and chooses the first ready entry in declaration order.

`Supervisor` owns each successful adapter handle. A failed start blocks new
starts until reverse rollback. A failed stop retains its handle for retry;
the supervisor never claims that owner was released. Shutdown uses the same
reverse order. The adapter must leave a handle retriable when stop fails.

This crate is a `no_std` policy model. K1250 must exercise real EL0 service
startup and rollback evidence. Driver completion and product release are
separate gates.